What’s Vulnerable › Vulnerabilities
CVE-2026-20332: Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Access Control Vulnerabilities
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-18
- Weakness: CWE-284
Description
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20332 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Summary
Cisco released a hardening update for Cisco Secure ASA Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software addressing multiple internally discovered improper access control vulnerabilities (CWE-284) tracked as CVE-2026-20332, rated critical with a CVSS score of 9.9. Successful exploitation could let an attacker bypass access controls, with serious impact on affected firewall and management deployments. There is no evidence of active exploitation: the flaw is not in CISA KEV, CISA SSVC lists exploitation as none, and EPSS estimates a 0.4% chance of exploitation within 30 days. Affected organizations should apply the September 2026 hardening release for the listed Cisco products; no specific fixed version numbers were provided, so consult Cisco's advisory for exact releases and any mitigations.
أصدرت Cisco تحديث تقوية لبرامج Cisco Secure ASA Software وSecure Firewall Threat Defense Software وSecure Firewall Management Center Software يعالج عدة ثغرات في التحكم في الوصول (CWE-284) اكتُشفت داخلياً وتُتابع تحت المعرف CVE-2026-20332، وقد صُنّفت حرجة بدرجة CVSS قدرها 9.9. قد تتيح الاستغلال الناجح للمهاجم تجاوز ضوابط الوصول، بما يؤثر تأثيراً خطيراً على عمليات نشر الجدران النارية وأنظمة الإدارة المتأثرة. لا توجد أدلة على استغلال نشط: الثغرة ليست ضمن CISA KEV، وتصنّف CISA SSVC الاستغلال بأنه none، ويقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.4%. على المؤسسات المتأثرة تطبيق إصدار التقوية الصادر في سبتمبر 2026 للمنتجات المذكورة؛ ولم تُذكر أرقام إصدارات محددة، لذا يُرجى الرجوع إلى إرشاد Cisco لمعرفة الإصدارات الدقيقة وأي إجراءات تخفيف.
Affected products
- Cisco ASA Software: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11 (+115)
- Cisco Firepower Management Center: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0 (+62)
- Cisco Firepower Threat Defense Software: 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3 (+35)
In the news
References
Get alerted when CVE-2026-20332 or the next vulnerability affects your stack